CVE-2026-81091
mcp-use Inspector Proxy Server-Side Request Forgery via Caller-Supplied Target URL
Using mcp-use by mcp-use?
Get instant alerts when new vulnerabilities affect mcp-use - before attackers find them.
Description
The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the __mcp_target parameter and proxied to it without inspecting the host, so loopback, link-local and private addresses were all accepted, as were names that resolve to them, and the validation was not reapplied to a redirect the destination returned. A caller could therefore make the server issue requests to addresses reachable only from the host it runs on and read the responses. The current code calls isSafeProxyTarget, which checks the resolved address against private, loopback and link-local ranges before proxying and bounds the number of redirects followed.
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
References (3)
SSVC — Action Prioritization
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
- Attack Vector
- NETWORK
- Complexity
- LOW
- Privileges
- NONE
- User Interaction
- NONE
- Scope
- CHANGED
- Confidentiality
- HIGH
- Integrity
- NONE
- Availability
- NONE
Quick Info
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.